@astram/identity 0.5.0 → 0.7.0

package/dist/features/identity-feature.module.d.ts

@@ -1,5 +1,13 @@
 import { type DynamicModule } from '@nestjs/common';
 import { type ObjectTypeInput } from '@astram/engine';
+/**
+ * The boot check behind {@link IDENTITY_DECISION_AUTHORITY_CHECK}: with this module wired, the
+ * request path must decide with the authority guard built from this module's inputs. A missing
+ * authority (no `ShieldModule`) or the deny-everything stub (a guard that does not read
+ * `SHIELD_RECORD_AUTHORIZATION`) fails the boot instead of silently denying, or deciding with a
+ * different registry. (Another source next to this one is refused by `ShieldModule` itself.)
+ */
+export declare function assertRequestPathUsesIdentityAuthorization(authority: unknown): true;
 /**
  * IdentityFeatureModule — the framework-owned identity FEATURE surface (company/user/role CRUD;
  * more in later phases) as thin controllers over the engine's RecordsService. The CONSUMER imports
@@ -19,12 +27,13 @@ export declare class IdentityFeatureModule {
      *   by the writer's own `decide()` (a route-allows/writer-denies split). Omitted ⇒
      *   `isRoot` is always false (a non-root consumer works; only a root offering
      *   cross-tenant grants needs it). See ADR-0026 + the template wiring.
-     * @param extraObjects the consumer's OWN registered object types — pass the SAME array
-     *   given to `buildIdentityRecordAuthorization(pool, extraObjects)`. Without them, the
-     *   guided rule-builder SCHEMA (Phase 5) and the OWNER-SHARE resolver (Phase 6) only know
-     *   the framework identity types, so a consumer's own OWNED type (e.g. `note`) is NOT
-     *   policy-authorable and NOT shareable ("type '…' is not registered — cannot share").
-     *   Passing them here lets an owner share their own records + author policies over them.
+     * @param extraObjects the consumer's OWN registered object types (the ones it registers with
+     *   `EngineModule.forFeature`). The ONE place they are given (Phase 9 #7): the module builds
+     *   the record authorization from `[...identityObjects, ...extraObjects]` and provides it to
+     *   `ShieldModule` (request path, gate-5 key projection), and uses the same registry for its
+     *   cross-tenant / policy authority, grant ceiling, guided rule-builder schema and owner-share
+     *   resolver. Without them a consumer type is unregistered everywhere (denied), not policy-
+     *   authorable and not shareable ("type '…' is not registered — cannot share").
      */
     static forRoot({ rootIds, extraObjects, }?: {
         rootIds?: readonly string[];

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA6FxB;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CAscvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA6FxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAiBD;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CA8dvB"}

package/dist/features/identity-feature.module.js

@@ -8,6 +8,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var IdentityFeatureModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdentityFeatureModule = void 0;
+exports.assertRequestPathUsesIdentityAuthorization = assertRequestPathUsesIdentityAuthorization;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const engine_1 = require("@astram/engine");
@@ -58,6 +59,35 @@ const grant_authorize_js_1 = require("./cross-tenant/grant-authorize.js");
 const IDENTITY_VERSION_PUBLISHER_LINK = Symbol('IDENTITY_VERSION_PUBLISHER_LINK');
 /** DI token of the boot check that warns when a user disable cannot revoke sessions. */
 const IDENTITY_SESSION_REVOCATION_CHECK = Symbol('IDENTITY_SESSION_REVOCATION_CHECK');
+/** DI token of the boot check that the request path decides with this module's authorization. */
+const IDENTITY_DECISION_AUTHORITY_CHECK = Symbol('IDENTITY_DECISION_AUTHORITY_CHECK');
+/**
+ * Holds the record-authorization inputs `IdentityFeatureModule.forRoot` builds, provided GLOBALLY
+ * under guard's `SHIELD_RECORD_AUTHORIZATION` so `ShieldModule` (a sibling, which never imports
+ * identity) builds the request-path decision authority from them (Phase 9 #7). Only this token is
+ * global; the feature module's own providers stay module-scoped.
+ */
+let IdentityRecordAuthorizationModule = class IdentityRecordAuthorizationModule {
+};
+IdentityRecordAuthorizationModule = __decorate([
+    (0, common_1.Module)({})
+], IdentityRecordAuthorizationModule);
+/**
+ * The boot check behind {@link IDENTITY_DECISION_AUTHORITY_CHECK}: with this module wired, the
+ * request path must decide with the authority guard built from this module's inputs. A missing
+ * authority (no `ShieldModule`) or the deny-everything stub (a guard that does not read
+ * `SHIELD_RECORD_AUTHORIZATION`) fails the boot instead of silently denying, or deciding with a
+ * different registry. (Another source next to this one is refused by `ShieldModule` itself.)
+ */
+function assertRequestPathUsesIdentityAuthorization(authority) {
+    if (authority === undefined || authority === null || authority === guard_1.stubDecisionAuthority) {
+        throw new Error('IdentityFeatureModule: the request path has no decision authority built from the identity ' +
+            'record authorization. Import ShieldModule.forRoot(...) from @astram/guard >= 0.10 ' +
+            'without `recordAuthorization`/`decisionAuthority`: it builds the authority from the ' +
+            'inputs IdentityFeatureModule provides (SHIELD_RECORD_AUTHORIZATION).');
+    }
+    return true;
+}
 /** Map guard's env DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). */
 function engineDbFromEnv() {
     const db = (0, guard_1.loadDbConfig)();
@@ -91,28 +121,39 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
      *   by the writer's own `decide()` (a route-allows/writer-denies split). Omitted ⇒
      *   `isRoot` is always false (a non-root consumer works; only a root offering
      *   cross-tenant grants needs it). See ADR-0026 + the template wiring.
-     * @param extraObjects the consumer's OWN registered object types — pass the SAME array
-     *   given to `buildIdentityRecordAuthorization(pool, extraObjects)`. Without them, the
-     *   guided rule-builder SCHEMA (Phase 5) and the OWNER-SHARE resolver (Phase 6) only know
-     *   the framework identity types, so a consumer's own OWNED type (e.g. `note`) is NOT
-     *   policy-authorable and NOT shareable ("type '…' is not registered — cannot share").
-     *   Passing them here lets an owner share their own records + author policies over them.
+     * @param extraObjects the consumer's OWN registered object types (the ones it registers with
+     *   `EngineModule.forFeature`). The ONE place they are given (Phase 9 #7): the module builds
+     *   the record authorization from `[...identityObjects, ...extraObjects]` and provides it to
+     *   `ShieldModule` (request path, gate-5 key projection), and uses the same registry for its
+     *   cross-tenant / policy authority, grant ceiling, guided rule-builder schema and owner-share
+     *   resolver. Without them a consumer type is unregistered everywhere (denied), not policy-
+     *   authorable and not shareable ("type '…' is not registered — cannot share").
      */
     static forRoot({ rootIds, extraObjects = [], } = {}) {
         // ONE shared shield_authz pool for the whole grant-admin stack (ADR-0011): the
         // permission-version bumper, the AccessBundleStore, the GrantAdminService, and the two
         // reconcile jobs all run over this single pool (don't open several). Opened once at
-        // forRoot() (not import time) — mirrors the pre-existing bump-pool pattern.
+        // forRoot() (not import time) — mirrors the pre-existing bump-pool pattern. Since Phase 9 #7
+        // it also backs the request path's decision authority (provided to ShieldModule below).
         const authzPool = (0, record_authorization_js_1.createIdentityAuthzPool)();
+        // The ONE record authorization (Phase 9 #7, closes KI #55/#57): built here from this module's
+        // own `extraObjects`, provided to ShieldModule under SHIELD_RECORD_AUTHORIZATION, and reused for
+        // every internal authority below. Its registry is the ONE key universe: the grant ceiling sees
+        // every key the request path grants (review M5 / Phase 8 #4), and a consumer type is
+        // registered for the cross-tenant writer and the policy author too.
+        const recordAuthorization = (0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool, extraObjects);
+        const ceilingRegistry = recordAuthorization.registry;
         const bumper = new permission_version_bumper_js_1.PermissionVersionBumper();
         const postingVersionBump = {
             bumpTenant: (tenantUuid) => bumper.bumpForTenant(tenantUuid, authzPool),
             // A user disabled/re-enabled: every membership tenant (autocommit pool → published at once).
             bumpForUser: (userUuid) => bumper.bumpForUser(userUuid, authzPool),
+            // A role delete (Phase 8 #2): its holder tenants, read before the delete cascades postings.
+            tenantsForRole: (roleUuid) => bumper.tenantsForRole(roleUuid, authzPool),
         };
         // The core ModuleRegistry the catalog reconcile job needs, built from the identity
-        // object registrations (guard's bridge reflects decorated classes → registry). Built BEFORE
-        // the grant-admin service so the GrantCeiling (ADR-0029) can share it as the key universe.
+        // object registrations only (guard's bridge reflects decorated classes → registry): it
+        // catalogs the identity permissions. Authorities use the shared `recordAuthorization.registry`.
         const identityRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects]);
         // The grant-admin collaborators built at forRoot() over the shared pool (mirrors the
         // postingVersionBump closure pattern above). GrantCeiling (ADR-0029) enforces the
@@ -120,12 +161,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // resolved over the SAME authz pool + registry the object-type gate uses (one source of
         // truth for "what a principal holds"). ALWAYS wired here, so production always enforces.
         const accessBundleStore = new access_bundle_store_js_1.AccessBundleStore(authzPool);
-        // The ceiling's key universe includes the consumer's `extraObjects` (the SAME registry shape
-        // `buildIdentityRecordAuthorization(pool, extraObjects)` gives the decision path): otherwise a
-        // role holding a consumer-type key could never be assigned or granted by a non-root admin who
-        // holds that key (review M5) — the security-hardening role-assignment ceiling makes that
-        // reachable from every posting edit. `rootIds` marks platform roots as never dominated.
-        const ceilingRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
+        // (`ceilingRegistry` is the shared record-authorization registry built at the top of forRoot.)
+        // `rootIds` marks platform roots as never dominated.
         // rootIds is passed EXPLICITLY (review F5): `null` states "not configured". The dominance
         // check still refuses any user flagged `u_is_platform_superuser`, so an unconfigured list
         // never lets a sub-admin take over a platform administrator.
@@ -146,7 +183,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         const scopeClosureService = new scope_closure_service_js_1.ScopeClosureService(authzPool, bumper);
         // Company hierarchy (security hardening #2): the ONLY path that moves/deletes/attaches a company
         // node — through the closure service above — audited on the move/delete transaction.
-        const companyHierarchyService = new company_hierarchy_service_js_1.CompanyHierarchyService(authzPool, scopeClosureService, new engine_1.MariaDbAuditSink({}));
+        const companyHierarchyService = new company_hierarchy_service_js_1.CompanyHierarchyService(authzPool, scopeClosureService, grantCeiling, // Phase 8 #3: a company delete must dominate every member
+        new engine_1.MariaDbAuditSink({}));
         // Audit viewer (Phase 5): the AuditReader + LabelResolver over the SAME shared authzPool
         // (the reader queries shield_audit + the resolver/actor-lookup query shield_app, both
         // reachable by that pool). `auditNameToId` is the actor-name -> uuid reverse lookup for the
@@ -165,7 +203,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // authz.module, the anti-pattern this replaces). A SECOND DecisionAuthority is built over the
         // same record-authorization inputs (matches astram3): the route guard's own decide() is the
         // first; this one backs the writer's server-side re-verification.
-        const crossTenantAuthority = (0, guard_1.buildRecordAuthorization)((0, record_authorization_js_1.buildIdentityRecordAuthorization)(authzPool));
+        // Same inputs as the request path (KI #57): a consumer type is registered here too.
+        const crossTenantAuthority = (0, guard_1.buildRecordAuthorization)(recordAuthorization);
         // Record-level LIST SCOPE (Task 3.1, Invariant #8): the engine-facing fn the engine's
         // `list()` ANDs into BOTH the data SELECT and the COUNT — the in-query visible-set filter.
         // Built HERE, over the SAME shared authzPool (guard constructs the un-overridable scope
@@ -173,7 +212,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // out-of-the-box into `EngineModule.forRoot({ listScope })` below (ADR-0003 injection seam —
         // the engine never imports guard). Fail-closed: a store outage propagates and `list()` fails
         // rather than returning unscoped rows.
-        const listScope = (0, guard_1.buildListScopeFn)((0, record_authorization_js_1.buildIdentityRecordAuthorization)(authzPool));
+        const listScope = (0, guard_1.buildListScopeFn)(recordAuthorization);
         // The writer's `GrantAuthorizeFn`: decide()-backed, fail-closed (no try/catch — a throw
         // propagates and the writer maps it to a retryable 503). isRoot ← the SAME rootIds the
         // consumer passes to ShieldModule.forRoot (root-correctness for control-plane grants).
@@ -227,11 +266,12 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             audit: grantAudit,
         });
         // The read side (inbox/mine/incoming/offerable-types) over the same pool + the merged object
-        // set (offerable = tenantScoped types only) + the per-type action vocabulary.
-        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects], guard_1.actionsFor);
+        // set (offerable = tenantScoped types only, the consumer's included, KI #57) + the per-type
+        // action vocabulary.
+        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects, ...extraObjects], guard_1.actionsFor);
         // ── GUIDED RULE-BUILDER (list-scoping engine Phase 5, §9.1) ──────────────────────────────
         // The policy-authoring surface over the guard `MariaDbPolicyStore` + core `makeAuthorPolicy`.
-        // Reuses the SAME `identityRegistry` + `crossTenantAuthority` (a DecisionAuthority over the
+        // Reuses the SAME shared registry + `crossTenantAuthority` (a DecisionAuthority over the
         // shared authzPool — the delegated-admin ceiling's decide()) as the cross-tenant writer. The
         // core AuditSink is one-arg (`record(event)`); the engine `MariaDbAuditSink` is two-arg
         // (`record(event, query)`) — so bind the query to the shared authzPool (mirrors the
@@ -265,7 +305,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             };
         });
         const policyService = new policy_service_js_1.PolicyService({
-            registry: identityRegistry,
+            // The shared registry (KI #57): the schema below already offers the consumer's types, so
+            // the author must know their actions too.
+            registry: recordAuthorization.registry,
             policyStore,
             decide: crossTenantAuthority,
             audit: policyAudit,
@@ -391,6 +433,14 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // NestJS DiscoveryService/MetadataScanner — the boot bootstrap provider reflects the
                 // live controllers through this to build the OperationInventory.
                 core_1.DiscoveryModule,
+                // Phase 9 #7: the ONE record authorization, global so ShieldModule's decision-authority
+                // factory reads it (guard never imports identity; the token is the seam).
+                {
+                    module: IdentityRecordAuthorizationModule,
+                    global: true,
+                    providers: [{ provide: guard_1.SHIELD_RECORD_AUTHORIZATION, useValue: recordAuthorization }],
+                    exports: [guard_1.SHIELD_RECORD_AUTHORIZATION],
+                },
             ],
             // Route order: RoleController stays AHEAD of GrantAdminController (documented Nest
             // route-precedence constraint — the summary route `access/role-grants` dodges
@@ -439,6 +489,13 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                         { token: guard_1.SHIELD_SESSION_SWEEPER, optional: true },
                     ],
                 },
+                // Phase 9 #7: fail the boot unless the request path decides with the authority guard
+                // built from this module's record authorization (never the silent deny-everything stub).
+                {
+                    provide: IDENTITY_DECISION_AUTHORITY_CHECK,
+                    useFactory: assertRequestPathUsesIdentityAuthorization,
+                    inject: [{ token: guard_1.SHIELD_DECISION_AUTHORITY, optional: true }],
+                },
                 {
                     provide: IDENTITY_VERSION_PUBLISHER_LINK,
                     useFactory: (cache) => {

package/dist/features/membership/posting-version-bump.d.ts

@@ -10,6 +10,13 @@ export interface PostingVersionBump {
      * the account itself was disabled or re-enabled. Returns the bumped tenants; throws on failure.
      */
     bumpForUser?(userUuid: string): Promise<string[]>;
+    /**
+     * OPTIONAL (Phase 8 #2): the tenants whose cached grants change when the role goes away — every
+     * tenant where it is actively posted, plus every service account's tenant holding it. Read
+     * BEFORE a role delete (the delete cascades the postings); bump each with `bumpTenant` after the
+     * commit. Throws on failure.
+     */
+    tenantsForRole?(roleUuid: string): Promise<string[]>;
 }
 export declare const POSTING_VERSION_BUMP: unique symbol;
 //# sourceMappingURL=posting-version-bump.d.ts.map

package/dist/features/membership/posting-version-bump.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting-version-bump.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting-version-bump.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD;AAED,eAAO,MAAM,oBAAoB,eAAiC,CAAC"}
+{"version":3,"file":"posting-version-bump.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting-version-bump.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD;;;;;OAKG;IACH,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD;AAED,eAAO,MAAM,oBAAoB,eAAiC,CAAC"}

package/dist/features/membership/posting.service.d.ts

@@ -14,6 +14,8 @@
  *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
  *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
  *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *   - for every ADDED posting: its department and branch belong to the membership's company
+ *     (`assertOrgUnitsInCompany`, Phase 9 #13b) — else 400.
  *
  * ── Atomicity (KI #16) ────────────────────────────────────────────────────────────────
  * The diff runs inside ONE `records.transaction` (ADR-0034): creates FIRST, then deletes, so a

package/dist/features/membership/posting.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;CAuGjB"}
+{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;CA8GjB"}

package/dist/features/membership/posting.service.js

@@ -15,6 +15,8 @@
  *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
  *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
  *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *   - for every ADDED posting: its department and branch belong to the membership's company
+ *     (`assertOrgUnitsInCompany`, Phase 9 #13b) — else 400.
  *
  * ── Atomicity (KI #16) ────────────────────────────────────────────────────────────────
  * The diff runs inside ONE `records.transaction` (ADR-0034): creates FIRST, then deletes, so a
@@ -163,6 +165,13 @@ let PostingService = class PostingService {
             await this.ceiling.assertRoleAssignable(actor, roleUuid);
         }
         await this.ceiling.assertCanAssignRoles(actor, addedRoles);
+        // Phase 9 #13b (review F4): an added posting's department/branch must be the membership
+        // company's own (junction rows), never another tenant's (400).
+        const present = (v) => typeof v === 'string' && v.length > 0;
+        await this.ceiling.assertOrgUnitsInCompany(tenantUuid, {
+            departmentUuids: added.map((d) => d.departmentUuid).filter(present),
+            branchUuids: added.map((d) => d.branchUuid).filter(present),
+        });
         // Removing a PEER's postings strips their authority: the actor must dominate the member
         // (security review). Removing your OWN postings (self-demotion) stays allowed.
         const memberUuid = typeof membership.fields?.userUuid === 'string' ? membership.fields.userUuid : '';

package/dist/features/role/role.service.d.ts

@@ -2,6 +2,8 @@ import { RecordsService, type RecordId } from '@astram/engine';
 import type { Principal } from '@astram/core';
 import { type ListParams } from '../shared/list-query.js';
 import { GrantCeiling } from '../authz/grant-ceiling.js';
+import { GrantAdminService } from '../authz/grant-admin.service.js';
+import { type PostingVersionBump } from '../membership/posting-version-bump.js';
 /**
  * RoleService — role CRUD on the paved road, via the framework's RecordsService
  * facade. The facade supplies the acting identity (the request principal) for the pipe;
@@ -15,7 +17,9 @@ import { GrantCeiling } from '../authz/grant-ceiling.js';
 export declare class RoleService {
     private readonly records;
     private readonly ceiling;
-    constructor(records: RecordsService, ceiling: GrantCeiling);
+    private readonly versionBump?;
+    private readonly grants?;
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined, grants?: (GrantAdminService | null) | undefined);
     /** Create a role. */
     createRole(name: string): Promise<RecordId>;
     /** List roles (tenant-scoped by the pipe), with paging/search/sort. */
@@ -26,7 +30,33 @@ export declare class RoleService {
     updateRole(actor: Principal, uuid: string, patch: {
         name?: unknown;
     }): Promise<void>;
-    /** Delete a role — only a role the actor may administer (binding rule). */
+    /**
+     * Delete a role — only a role the actor may administer (binding rule) AND whose every holder the
+     * actor dominates (Phase 8 #2: the delete cascades the holders' postings, stripping their
+     * authority). In ONE transaction: lock the role row (the posting and grant paths lock the same
+     * row first), re-check the binding rule and holder dominance against what is committed now, read
+     * the holder tenants (before the cascade removes the postings), then delete. After the commit,
+     * every holder tenant's permission version is bumped so cached roles drop at the next request.
+     * The bump runs after the commit, never before: an earlier bump would let a session reload the
+     * pre-delete roles under the new version. A bump failure throws (503) rather than leave holders'
+     * cached grants silently stale.
+     *
+     * The role's `role_permission` rows (shield_authz, no FK) and its place in every service
+     * account's `sa_role_ids` (read live by the API-key store) do not cascade, so
+     * `GrantAdminService.purgeRole` removes both in its own committed authz transaction — checking
+     * first that the actor may change each holding account, and bumping every tenant that used the
+     * role (account tenants included).
+     *
+     * Phase 9 #5: the engine's delete (its full gate: the coarse `role:delete` decision, then the
+     * record-level one, through the single decision authority) runs BEFORE the purge, on this
+     * transaction. A refused delete throws before anything is purged, so nothing changes. The purge
+     * then commits on its own connection while this transaction still holds the role row; it reads
+     * only committed state (the postings this delete removes are still visible to it, so their
+     * tenants are bumped). A purge refusal or failure rolls the delete back. A failure after the
+     * purge committed (this commit) leaves a role with no grants and no agents: fewer permissions,
+     * never live grants or an agent carrying a deleted role. A re-created role gets a fresh uuid
+     * (the engine mints it), so it can never pick up anything left behind.
+     */
     deleteRole(actor: Principal, uuid: string): Promise<void>;
 }
 //# sourceMappingURL=role.service.d.ts.map

package/dist/features/role/role.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD;;;;;;;;;GASG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY;IAGxC,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI3C,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,8FAA8F;IACxF,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1F,2EAA2E;IACrE,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIhE"}
+{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAK/C;;;;;;;;;GASG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAXP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,MAAM,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAGpD,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI3C,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,8FAA8F;IACxF,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoBhE"}

package/dist/features/role/role.service.js

@@ -8,12 +8,18 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RoleService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
+const core_1 = require("@astram/core");
 const list_query_js_1 = require("../shared/list-query.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const grant_admin_service_js_1 = require("../authz/grant-admin.service.js");
+const posting_version_bump_js_1 = require("../membership/posting-version-bump.js");
 const ROLE_SEARCH_FIELDS = ['name'];
 const ROLE_SORT_FIELDS = ['name', 'createdAt'];
 /**
@@ -29,9 +35,13 @@ const ROLE_SORT_FIELDS = ['name', 'createdAt'];
 let RoleService = class RoleService {
     records;
     ceiling;
-    constructor(records, ceiling) {
+    versionBump;
+    grants;
+    constructor(records, ceiling, versionBump, grants) {
         this.records = records;
         this.ceiling = ceiling;
+        this.versionBump = versionBump;
+        this.grants = grants;
     }
     /** Create a role. */
     createRole(name) {
@@ -53,15 +63,65 @@ let RoleService = class RoleService {
             fields.name = patch.name;
         await this.records.update('role', uuid, { fields });
     }
-    /** Delete a role — only a role the actor may administer (binding rule). */
+    /**
+     * Delete a role — only a role the actor may administer (binding rule) AND whose every holder the
+     * actor dominates (Phase 8 #2: the delete cascades the holders' postings, stripping their
+     * authority). In ONE transaction: lock the role row (the posting and grant paths lock the same
+     * row first), re-check the binding rule and holder dominance against what is committed now, read
+     * the holder tenants (before the cascade removes the postings), then delete. After the commit,
+     * every holder tenant's permission version is bumped so cached roles drop at the next request.
+     * The bump runs after the commit, never before: an earlier bump would let a session reload the
+     * pre-delete roles under the new version. A bump failure throws (503) rather than leave holders'
+     * cached grants silently stale.
+     *
+     * The role's `role_permission` rows (shield_authz, no FK) and its place in every service
+     * account's `sa_role_ids` (read live by the API-key store) do not cascade, so
+     * `GrantAdminService.purgeRole` removes both in its own committed authz transaction — checking
+     * first that the actor may change each holding account, and bumping every tenant that used the
+     * role (account tenants included).
+     *
+     * Phase 9 #5: the engine's delete (its full gate: the coarse `role:delete` decision, then the
+     * record-level one, through the single decision authority) runs BEFORE the purge, on this
+     * transaction. A refused delete throws before anything is purged, so nothing changes. The purge
+     * then commits on its own connection while this transaction still holds the role row; it reads
+     * only committed state (the postings this delete removes are still visible to it, so their
+     * tenants are bumped). A purge refusal or failure rolls the delete back. A failure after the
+     * purge committed (this commit) leaves a role with no grants and no agents: fewer permissions,
+     * never live grants or an agent carrying a deleted role. A re-created role gets a fresh uuid
+     * (the engine mints it), so it can never pick up anything left behind.
+     */
     async deleteRole(actor, uuid) {
         await this.ceiling.assertRoleAdministrable(actor, uuid);
-        await this.records.delete('role', uuid);
+        const grants = this.grants;
+        if (!grants)
+            throw new core_1.AuthorizationUnavailableError('role grant purge is not configured');
+        const tenants = await this.records.transaction(async (tx) => {
+            await tx.lockForUpdate('role', uuid);
+            await this.ceiling.assertRoleAdministrable(actor, uuid);
+            await this.ceiling.assertDominatesRoleHolders(actor, uuid);
+            const affected = (await this.versionBump?.tenantsForRole?.(uuid)) ?? [];
+            await tx.delete('role', uuid); // the engine's delete gate decides first (Phase 9 #5)
+            await grants.purgeRole(uuid, actor);
+            return affected;
+        });
+        if (!this.versionBump)
+            return;
+        try {
+            for (const tenant of tenants)
+                await this.versionBump.bumpTenant(tenant);
+        }
+        catch (cause) {
+            throw new core_1.AuthorizationUnavailableError('permission version bump failed', cause);
+        }
     }
 };
 exports.RoleService = RoleService;
 exports.RoleService = RoleService = __decorate([
     (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(grant_admin_service_js_1.GrantAdminService)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling])
+        grant_ceiling_js_1.GrantCeiling, Object, Object])
 ], RoleService);

package/dist/features/scope/scope-closure.service.d.ts

@@ -88,6 +88,10 @@ export declare class ScopeClosureService {
      * subtree, so those admins' cached session subtrees are stale (they'd keep the deleted node in
      * their set) — bump them so they re-derive at the next refresh (same discipline as moveNode's
      * former-parent bump; without it, a parent admin's list/decide would reference a gone node).
+     * Also bumps the deleted node's own tenant (Phase 8 #3). `beforeDelete` runs first, on the same
+     * transaction, so a caller can lock the node and refuse (rollback) before anything changes; it
+     * may also retire rows that depend on the node and return the tenants those changes touched,
+     * which are bumped with the rest.
      *
      * v1 SCOPE NOTE: this refuses a node with CHILDREN. Broader resource-orphan cleanup (rows in
      * the many tenant-scoped app tables that reference the deleted node) is out of scope for v1 and
@@ -95,7 +99,13 @@ export declare class ScopeClosureService {
      */
     deleteNode(nodeUuid: string, 
     /** Runs on the delete's transaction after the bump (e.g. the audit row) — a throw rolls back. */
-    inTransaction?: (conn: ScopeConn) => Promise<void>): Promise<void>;
+    inTransaction?: (conn: ScopeConn) => Promise<void>, 
+    /**
+     * Runs on the delete's transaction BEFORE anything is deleted (Phase 8 #3: lock the node, check
+     * authority over its members and agents, retire its agents and cross-tenant grants) — a throw
+     * rolls back and nothing is deleted or bumped. Returned tenant ids are bumped too.
+     */
+    beforeDelete?: (conn: ScopeConn) => Promise<void | readonly string[]>): Promise<void>;
     /** Read the node forest's parent edges (`c_uuid` → `c_parent_uuid`) as `ScopeEdge[]`. */
     private readEdges;
     /**

package/dist/features/scope/scope-closure.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAOlF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB;IAG7C;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAwCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;;;;;;OAYG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM;IAChB,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAoChB,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG;IAC7D,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CA8BA;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}
+{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAOlF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB;IAG7C;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAwCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM;IAChB,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,MAAM,EAAE,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC;IA6ChB,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG;IAC7D,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CA8BA;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}

package/dist/features/scope/scope-closure.service.js

@@ -246,6 +246,10 @@ class ScopeClosureService {
      * subtree, so those admins' cached session subtrees are stale (they'd keep the deleted node in
      * their set) — bump them so they re-derive at the next refresh (same discipline as moveNode's
      * former-parent bump; without it, a parent admin's list/decide would reference a gone node).
+     * Also bumps the deleted node's own tenant (Phase 8 #3). `beforeDelete` runs first, on the same
+     * transaction, so a caller can lock the node and refuse (rollback) before anything changes; it
+     * may also retire rows that depend on the node and return the tenants those changes touched,
+     * which are bumped with the rest.
      *
      * v1 SCOPE NOTE: this refuses a node with CHILDREN. Broader resource-orphan cleanup (rows in
      * the many tenant-scoped app tables that reference the deleted node) is out of scope for v1 and
@@ -253,7 +257,13 @@ class ScopeClosureService {
      */
     async deleteNode(nodeUuid, 
     /** Runs on the delete's transaction after the bump (e.g. the audit row) — a throw rolls back. */
-    inTransaction) {
+    inTransaction, 
+    /**
+     * Runs on the delete's transaction BEFORE anything is deleted (Phase 8 #3: lock the node, check
+     * authority over its members and agents, retire its agents and cross-tenant grants) — a throw
+     * rolls back and nothing is deleted or bumped. Returned tenant ids are bumped too.
+     */
+    beforeDelete) {
         // Under the tree lock (review F3): a concurrent move cannot hang a child under this node
         // between the children check and the delete.
         await this.inTreeLock(async (conn) => {
@@ -261,6 +271,7 @@ class ScopeClosureService {
             if (children.length > 0) {
                 throw new NodeHasChildrenError(nodeUuid);
             }
+            const touched = (beforeDelete ? await beforeDelete(conn) : undefined) ?? [];
             // The former-parent ancestry — the deleted node's ancestors (excluding self). They lose the
             // node from their reach → bump so their sessions re-derive. Read BEFORE the delete.
             const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
@@ -270,9 +281,17 @@ class ScopeClosureService {
           WHERE ancestor_uuid = ? OR descendant_uuid = ?`, [nodeUuid, nodeUuid]);
             // Remove the company row itself.
             await conn.query(`DELETE FROM \`${APP}\`.\`companies\` WHERE c_uuid = ?`, [nodeUuid]);
-            // Bump the former-parent ancestry so their cached subtrees re-derive at next refresh.
-            for (const { ancestor_uuid } of formerAncestryRows) {
-                await this.bumper.bumpForTenant(ancestor_uuid, conn);
+            // Bump the former-parent ancestry so their cached subtrees re-derive at next refresh, and the
+            // deleted node's OWN tenant (Phase 8 #3): its memberships and postings cascade away, so
+            // sessions cached in it must reload (and find nothing). A leaf has no descendants to bump.
+            // Plus the tenants `beforeDelete` touched (e.g. other tenants' agents that lost the node).
+            const bumpSet = new Set([
+                ...formerAncestryRows.map((r) => r.ancestor_uuid),
+                nodeUuid,
+                ...touched,
+            ]);
+            for (const tenant of bumpSet) {
+                await this.bumper.bumpForTenant(tenant, conn);
             }
             if (inTransaction)
                 await inTransaction(conn);

package/dist/features/service-account/lock-service-accounts.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Lock the service accounts matching a predicate, without locking the table (Phase 9 #11).
+ *
+ * `service_account` has no index a role or scope predicate can use (`JSON_CONTAINS` on a JSON
+ * column, or an `OR` with one), so `SELECT … WHERE <predicate> FOR UPDATE` scans the whole table
+ * and InnoDB (REPEATABLE READ) keeps a next-key lock on every row it scanned: every other agent's
+ * edit, and every new agent, waits until the transaction ends. Instead:
+ *   1. a NON-locking read finds the candidate ids (a consistent read, no locks);
+ *   2. `FOR UPDATE` by primary key locks only those rows, sorted by id (a stable lock order), and
+ *      re-evaluates the predicate on the latest committed version of each, so a candidate that
+ *      stopped matching in between is dropped.
+ *
+ * A row that STARTS matching after step 1 (an agent that gains the role, or the company in its
+ * scope) is not locked or returned. Callers accept that (see their docs): the outcome equals the
+ * serial order "this transaction, then that edit", which the table-wide lock also allowed (the
+ * edit only waited, then applied).
+ *
+ * `columns` and `where.sql` are fixed SQL written by the caller (never client input); every value
+ * is `?`-bound.
+ */
+/** The connection surface: one transaction's `query`. */
+export interface LockConn {
+    query(sql: string, params?: readonly unknown[]): Promise<unknown>;
+}
+export declare function lockServiceAccountsWhere<T>(conn: LockConn, columns: string, where: {
+    readonly sql: string;
+    readonly params: readonly unknown[];
+}): Promise<T[]>;
+//# sourceMappingURL=lock-service-accounts.d.ts.map

package/dist/features/service-account/lock-service-accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-service-accounts.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/lock-service-accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GACnE,OAAO,CAAC,CAAC,EAAE,CAAC,CAed"}